[AUTO-CHERRYPICK] [AutoPR- Security] Patch libarchive for CVE-2026-15028, CVE-2026-14164, CVE-2026-16517 [HIGH] - branch 3.0-dev - #18280
Conversation
azurelinux-ci-jwt-app
Bot
added
the
Auto Fast-track Cherry-pick
Auto Cherry-Pick SPEC Validation Summary
|
| Source (fasttrack) | Target (3.0-dev) | Resolved | |
|---|---|---|---|
| Version | 3.7.7 | 3.7.7 | 3.7.7 |
| Release | 7 | 7 | 7 |
| Patches | 15 | 13 | 15 |
| Conflict | Yes |
- Version-release 3.7.7-7 is not higher than Source 3.7.7-7
- Version-release 3.7.7-7 is not higher than Target 3.7.7-7
- Unresolved conflict markers (<<<<<<< / >>>>>>>) found in file
- Duplicate changelog entry for 3.7.7-7 (appears 2 times)
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
microsoft-github-policy-service
Bot
added
Packaging
3.0-dev
…6-16517 The AI-generated cherry-pick left literal <<<<<<< HEAD conflict markers in libarchive.spec. Rebuild it as a hand-crafted mirror of fasttrack commit 83ed843 so 3.0-dev converges with fasttrack's canonical -7 state: add Patch13 (CVE-2026-15028) + Patch14 (CVE-2026-16517), consolidate the existing -7 changelog entry to list all three CVEs. Release stays 7 (no bump) since fasttrack itself is at -7. Note: fasttrack subsequently reverted CVE-2026-16517 (#18282) — that will be delivered by companion PR #18284, keeping 3.0-dev's history as a faithful mirror of fasttrack's two-step land-then-revert. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26b18818-c4ef-43b9-ad6c-26bbf7c5259e
dc04baf to
40203fc
Compare
|
[Toolio Iglesias🗺️] Repushed the branch with a hand-crafted mirror of fasttrack commit What was wrong: the auto-cherry-pick left literal What's in the branch now (2 files added, 1 modified):
Sequencing note: fasttrack later reverted just CVE-2026-16517 ( |
The AI-generated cherry-pick had random line deletions in the CVE-16517 patch delete, a duplicated -5 changelog entry, and a mutated -7 date. Rebuild it as a clean revert on top of #18280's fixed branch, mirroring fasttrack commit eb40ad7: drop Patch14, delete CVE-2026-16517.patch, and trim the -7 changelog line to list just CVE-2026-15028 & CVE-2026-14164. Once #18280 merges, this PR's diff will naturally shrink to just the revert (base=3.0-dev). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 26b18818-c4ef-43b9-ad6c-26bbf7c5259e
|
[Toolio Iglesias🗺️] Closing — superseded by #18284. Because #18284's branch was built on top of this branch's rebuilt commit (add CVE-2026-15028 + CVE-2026-16517, then revert CVE-2026-16517), merging #18284 alone landed both changes on 3.0-dev in one shot. Current 3.0-dev tip has |
1 participant
This is an auto-generated pull request to cherry-pick commit 83ed843 to 3.0-dev. Original PR: #18078
In case of no merge conflicts, the PR is merged without approval because it's an automated cherry-pick of an already approved PR.
In case of merge conflicts, an AI-based conflict resolver will attempt to resolve conflicts and might make mistakes. The reviewer must check AI's work before approving.